UNIVERSITY OF CALIFORNIA SAN FRANCISCO MEDICAL CENTER

Report ID: FV4P11.03, California Department of Public Health

Reported Entity: UCSF MEDICAL CENTER

Issue:

Based on interview and record review, the hospital failed to maintain the confidentiality of protected health information (PHI) when:1. Patient 1's laboratory report was mailed to the wrong healthcare provider;2. Patient 2's Operative report was faxed to the wrong provider;3. Patient 3's Consultation letter was faxed to the wrong provider;4. Patient 4's After Visit Summary was emailed to another patient;5. Patient 5's laboratory results were mailed to the wrong patient; 6. Patient 6's laboratory results were mailed to the wrong patient; 7. Patient 7's personal information was handed to the wrong patient; 8. Patient 8's Surgical Pathology report was mailed to the wrong provider; 9. Patient 9's Consultation letter was faxed to the incorrect provider; 10. Patient 10's After Visit Summary was handed to the incorrect patient;11. Patient 11's Imaging report was mailed to an incorrect recipient; and 12. Patient 12's Imaging report was faxed to the wrong provider.These errors had the potential for embarrassment to the patients whose personal health information was released and the potential for future identity theft.Findings:1. CA00414178 (2014-223)During an interview on 10/22/14 at approximately 2:15 PM, the hospital's Privacy Analyst (PA 3) stated Patient 1's laboratory microbiology report was mailed to the incorrect provider. PA 3 stated the clerk entered the wrong five digit provider code and did not check the computer screen to verify the provider's name. PA 3 stated the hospital was notified of this mistake on 9/5/14 and Patient 1 was notified of the breach by letter dated 9/22/14.Record review indicated this report contained the following confidential health information for Patient 1: name, date of birth, age, sex, date specimen collected, results of the five test performed on the specimen.Record review indicated a faxed letter, dated 9/22/14, notifying the California Department of Public Health (CDPH) of the breach of Patient 1's protected health information.Record review indicated a letter, dated 9/22/14, notifying Patient 1 of the breach of his/her protected health information.2. CA00413842 (2014-219)During an interview on 10/22/14 at approximately 1:30 PM, PA 3 stated Patient 1's Operative report was faxed to the incorrect provider. PA 3 stated Patient 2 was a self-referral and the clerk entered self when registering this patient, instead of selecting self-referral. PA 3 said that the information was then automatically faxed to Nurse Practitioner Self. PA 3 stated the hospital was notified of this mistake on 9/15/14 and Patient 2 was notified of the breach by letter dated 9/17/14.Record review indicated this report contained the following confidential health information for Patient 2: name, medical record number, diagnosis, surgeon's name, date of surgery, clinical indications, surgery performed, and plan. Record review indicated a faxed letter, dated 9/18/14, notifying the California Department of Public Health (CDPH) of the breach of Patient 2's protected health information.Record review indicated a letter, dated 9/17/14, notifying Patient 2 of the breach of his/her protected health information. 3. CA00413842 (2014-219)During an interview on 10/22/14 at approximately 1:45 PM, PA 3 stated Patient 3's consultation letter was faxed to the wrong provider because the clerk selected the wrong provider. PA 3 stated the hospital was notified of this mistake on 9/15/14 and Patient 3 was notified of the breach by letter dated 9/18/14.Record review indicated this letter contained the following confidential health information for Patient 3: name, medical record number, date of birth, date of service, past medical history, past surgical history, current medications,review of systems, physical examination, test results, assessment, and recommendations. Record review indicated a faxed letter, dated 9/19/14, notifying the California Department of Public Health (CDPH) of the breach of Patient 3's protected health information.Record review indicated a letter, dated 9/18/14, notifying Patient 3 of the breach of his/her protected health information. 4. CA00414174 (2014-222) During an interview on 10/22/14 at approximately 2:00 PM, the hospital's Privacy Analyst (PA 1) stated Patient 4's After Visit Summary was emailed to the wrong patient. PA 1 stated the clerk was working on two files simultaneously, and emailed the After Visit Summary to the incorrect patient. PA 1 stated the hospital was notified of this mistake on 9/16/14 and Patient 4 was notified of the breach by letter dated 9/22/14.Record review indicated this report contained the following confidential health information for Patient 4: name, medical record number, pre-operative instructions and current medications.Record review indicated a faxed letter, dated 9/22/14, notifying the California Department of Public Health (CDPH) of the breach of Patient 4's protected health information.Record review indicated a letter, dated 9/22/14, notifying Patient 4 of the breach of his/her protected health information.5. CA00415088 (2014-224) During an interview on 10/22/14 at approximately 2:30 PM, the hospital's Privacy Analyst (PA 2) stated Patient 5's laboratory report was mailed to an incorrect patient. PA 2 stated the clerk was doing a batch mailing, contrary to the hospital's policy and procedure, and added the page with Patient 5's information to the wrong envelop. PA 2 stated the hospital was notified of this mistake on 9/24/14 and Patient 5 was notified of the breach by letter dated 9/29/14.Record review indicated this report contained the following confidential health information for Patient 5: name, address, test results, and physician comments regarding abnormal results. Record review indicated a faxed letter, dated 9/24/14, notifying the California Department of Public Health (CDPH) of the breach of Patient 5's protected health information.Record review indicated a letter, dated 9/29/14, notifying Patient 5 of the breach of his/her protected health information.6. CA00415454 (2014-226)During an interview on 10/22/14 at approximately 2:45 PM, PA 3 stated Patient 6's laboratory report was mailed to an incorrect provider. PA 3 stated the clerk entered the wrong five digit provider code and did not check the computer screen to verify the provider's name. PA 3 stated the hospital was notified of this mistake on 9/25/14 and Patient 6 was notified of the breach by letter dated 10/1/14.Record review indicated this report contained the following confidential health information for Patient 6: name, date of birth, age, sex, test results, and physician's name. Record review indicated a faxed letter, dated 10/1/14, notifying the California Department of Public Health (CDPH) of the breach of Patient 6's protected health information.Record review indicated a letter, dated 10/1/14, notifying Patient 6 of the breach of his/her protected health information.7. CA00415640 (2014-227)During an interview on 10/22/14 at approximately 3:00 PM, PA 2 stated Patient 7's personal information was handed to an incorrect patient. PA 2 stated the clerk misunderstood the physician's directions to hand a document, needed by the Army to treat his son, back to Patient 7 and instead, handed the document to a patient who was exiting the clinic. PA 2 stated the hospital was aware of this mistake on 9/26/14 when Patient 7 requested the document. PA 2 stated the hospital contacted the incorrect recipient and he/she returned the document. PA 2 said Patient 7 was notified of the breach by letter, dated 10/2/14, which contained additional information on credit monitoring to be provided by the hospital.Record review indicated the Army document contained the following confidential health information for Patient 7: name, address, email address, telephone number, social security number, son's name and social security number, and additional personal military identification information.;Record review indicated a faxed letter, dated 10/2/14, notifying the California Department of Public Health (CDPH) of the breach of Patient 7's protected health information and the protected health information of Patient 7's minor child.Record review indicated a letter, dated 10/2/14, notifying Patient 7 of the breach of his/her protected health information and his/her son's information.8. CA00415825 (2014-229)During an interview on 10/22/14 at approximately 3:15 PM, PA 2 stated Patient 8's Surgical Pathology Report was mailed to an incorrect provider. PA 2 stated the pathologist selected the wrong provider and this mis-information populated the mailing label. PA 2 stated the hospital was notified of this mistake on late on 9/28/14 and Patient 8 was notified of the breach by letter dated 10/3/14.Record review indicated this report contained the following confidential health information for Patient 8: name, date of birth, sex, medical record number, social security number, specimen description, test results, and clinical history.Record review indicated a faxed letter, dated 10/3/14, notifying the California Department of Public Health (CDPH) of the breach of Patient 8's protected health information.Record review indicated a letter, dated 10/3/14, notifying Patient 8 of the breach of his/her protected health information. 9. CA00417097 (2014-230)During an interview on 10/22/14 at approximately 3:30 PM, PA 2 stated Patient 9's consultation letter was faxed to the wrong provider because the clerk selected an incorrect provider in addition to the correct provider, and did not remove the incorrect provider. PA 2 stated the hospital was notified of this mistake on 10/9/14 and Patient 9's parent/guardian was notified of the breach by letter dated 10/15/14.Record review indicated this letter contained the following confidential health information for Patient 9: name, medical record number, date of birth, date of service, history of present illness, prior tests, current medications, past medical history, social history, family history, review of systems, physical examination, and diagnostic impression.. Record review indicated a faxed letter, dated 10/15/14/14, notifying the California Department of Public Health (CDPH) of the breach of Patient 9's protected health information.Record review indicated a letter, dated 10/15/14, notifying Patient 9's parent/guardian of the breach of Patient 9's protected health information.10. CA00417527 (2014-233) During an interview on 10/22/14 at approximately 4:00 PM, PA 1 stated Patient 10's After Visit Summary was emailed to the wrong patient. PA 1 stated the clerk took the documents from the printer and, without checking, handed Patient 10's Summary to another patient. PA 1 stated the hospital was notified of this mistake on 10/15/14 and Patient 10 was notified of the breach by letter dated 10/17/14.Record review indicated this report contained the following confidential health information for Patient 10: name, medical record number, date of birth, vital signs, allergies, current medications and scheduled appointments.Record review indicated a faxed letter, dated 10/17/14, notifying the California Department of Public Health (CDPH) of the breach of Patient 10's protected health information.Record review indicated a letter, dated 10/17/14, notifying Patient 10 of the breach of his/her protected health information. 11. CA00417539 (2014-234) During an interview on 10/22/14 at approximately 4:15 PM, PA 1 stated that Patient 11's Imagine results were mailed to the wrong insurance provider. PA 1 said the hospital was notified of this error on 10/13/14, and a letter was sent to Patient 11 on 10/17/14 notifying him/her of the breach of his/her medical information.Record review indicated a copy of the Imaging report which contained the following protected health information for Patient 11: name, medical record number, sex, date of birth, tests performed, clinical history, findings, and impression. Record review indicated a faxed letter, dated 10/17/14, notifying CDPH of the breach of Patient 11's medical information. Record review indicated a letter, dated 10/17/14, notifying Patient 11 of the breach of his/her medical information. 12. CA00417670 (2014-232) During an interview on 10/22/14 at approximately 3:45 PM, PA 3 stated that Patient 12's Imagine report was faxed to the wrong provider. PA 2 said the hospital was notified of this error on 10/13/14, and a letter was sent to Patient 12 on 10/17/14 notifying him/her of the breach of his/her medical information.Record review indicated a copy of the Imaging report which contained the following protected health information for Patient 12: name, medical record number, date of birth, tests performed, clinical history, and impression. Record review indicated a faxed letter, dated 10/17/14, notifying CDPH of the breach of Patient 12's medical information. Record review indicated a letter, dated 10/17/14, notifying Patient 12 of the breach of his/her medical information.

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights

Related Reports:

The report containing this deficiency also includes information about 2 other violations. Note that these may be related to the same event: FV4P11.01, FV4P11.02